Restricting API Token to a given root folder

Cinelist As Здравко indicated, Dropbox does not offer the ability to grant an app/access token access to specific existing folder(s) only, but I'll pass this along as a feature request. I can't promise if or when that might be implemented though.
 
The Dropbox API currently offers two levels of file/folder access: "app folder" and "full Dropbox". The closest option to your request would be the "app folder" access type. Apps with the app folder access type can only access the contents of a special app folder created for the app in the connected account. You can find more information on app permissions here. Scopes only control which functionality the app can access, not which content.

It's not possible to switch the access type on an existing Dropbox API app. If you want to change the access type used for an app that hasn't been released to users, you can do so by deleting the current API app registration and registering another with the desired permission. Deleting an API app in development mode frees up the name so you can register it again. Once you do, just be sure to update your app accordingly to use the new app key and secret. Access tokens for the deleted app will also no longer work.

If your app has already been released to users, we do not recommend disabling your API app, as it would break the integration for existing users. Instead, we recommend you register another API app for the other access type and add that as an option in your app.

You can register a new API app here.